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AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims : 

1 . (Currently amended) A method performed by one or more server devices, the method 
comprising: 

collecting, by one or more processors of the one or more server devices, information 
associated with a group of users visiting a web site that includes an advertising link, where the group 
of users visiting the web site includes a first set of non-malicious users and a different second set of 
malicious users; 

identifying, by one or more processors of the one or more server devices, the set of 
non-malicious users visiting the web site from the group of users visiting the web site based at least 
in part on the collected information; 

identifying, by one or more processors of the one or more server devices, a first 
proportion of a quantity number of non-malicious users visiting the web site to a total quantity 
number of users visiting the web site; [[and]] 

determining, by one or more processors of the one or more server devices, an 
occurrence of spamming on the web site, where the determining includes: 

identifying a second proportion of a quantity number of clicks on the 
advertising link by identified non-malicious users to a total quantity number of clicks on the 
advertising link by the group of users, and 

comparing the identified first proportion to the identified second proportion; 

and 

taking a remedial measure when the occurrence of spamming on the website is 
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determined . 

2. (Previously presented) The method of claim 1 where the collecting information 
includes: 

tracking activities of the group of users visiting the web site. 

3. (Currently amended) The method of claim 2 where the tracking activities includes: 
determining whether the users in the group of users load imageSi 

where identifying the set of non-malicious users includes identifying users, in the 
group of users, that are determined as loading images, 

where the set of non-malicious users includes the users that are determined as loading 

images . 

4. (Currently amended) The method of claim 2 where the tracking activities includes: 
determining whether the users in the group of users have javascript turned o^ 
where identifying the set of non-malicious users includes identifying users, in the 

group of users, that are determined as having javascript turned on, 

where the set of non-malicious users includes the users that are determined as having 
javascript turned on . 



5. 



(Currently amended) The method of claim 2 where the tracking activities includes: 
determining whether a typo of browser is used by the users in the group of userSi 
where identifying the set of non-malicious users includes identifying users, in the 
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group of users, that are determined as using a browser. 

where the set of non-malicious users includes the users that are determined as using a 

browser . 



6. (Currently amended) The method of claim 2 where the tracking activities includes: 

determining a number of times during an interval that at which each of the users in 

the group of users visits the web site A 

where identifying the set of malicious users includes identifying a first set of users, in 

the group of users, that are determined to have visited the web site a number of times, during the 

interval, that exceeds a threshold number of times, 

where the set of non-malicious users includes a second set of users, in the group of 

users, that is different from the identified first set of users . 



7. (Currently amended) The method of claim 2 where the web site is associated with a 
search engine, and 

where the tracking activities includes: 

determining a type of items for which searches are performed by the users in 

the group of userSj 

where identifying the set of malicious users includes identifying a first set of users, in 
the group of users, that are determined to have performed searches in an ordered manner, 

where the set of non-malicious users includes a second set of users, in the group of 
users, that is different from the first set of users . 
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8. (Previously presented) The method of claim 2 where the tracking activities includes: 

tracking activities of users in the group of users visiting another web site. 



9. (Previously presented) The method of claim 2 where each of the users in the group of 
users is associated with a cookie identifier, and 
where the tracking includes: 

using the cookie identifiers to track the activities of the users in the group of 

users. 



10. (Previously presented) The method of claim 1 where each of the users in the group of 
users is associated with a cookie identifier, and 

where the identifying non-malicious users includes: 

identifying non-malicious users based at least in part on an age of the cookie 
identifiers associated with the users in the group of users. 



1 1 . (Previously presented) The method of claim 1 where each of the users in the group of 
users is associated with a network address, and 

where the identifying non-malicious users includes: 

identifying the non-malicious users based at least in part on the network 
addresses associated with the users in the group of users. 



12. (Previously canceled) 
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13. (Previously canceled) 



14. (Previously canceled) 



15. (Currently amended) The method of claim 1 where the determining includes: 

determining an occurrence of spamming of at least one advertisement on the web site, 

and 

where taking the remedial measure the method further comprises: 

providing a refund in response to determining that the at least one 
advertisement has been spammed. 



16. (Currently amended) A system comprising: 
one or more server devices, comprising: 

means for providing a web site,! that includes at least one advertisement to a 
plurality of visitors, where the plurality of visitors includes a plurality of malicious visitors and a 
plurality of non-malicious visitors, 

means for identifying malicious visitors to the web site; 

means for identifying non-malicious visitors to the web site; 

means for determining a percentage of the non-malicious visitors out of the 
plurality of visitors to the website; 

means for tracking at least one activity of the identified non-malicious 

visitors; [[and]] 

means for determining an occurrence of click spamming on the web site based 
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at least in part on the tracked at least one activity of the identified non-malicious visitors, where the 

means for determining the occurrence of click spamming include: 

means for comparing the percentage of non-malicious users selecting 

the at least one advertisement during the time period to the percentage of non-malicious users 

visiting the web site during the time period, and 

means for determining that the at least one advertisement has been 

spammed when the percentage of non-malicious users selecting the at least one advertisement during 

the time period is significantly lower than the percentage of non-malicious users visiting the web site 

during the time period ; and 

means for taking a remedial measure when the occurrence of click spamming on the 

website is determined . 

17. (Currently amended) A computer-readable memory device containing instructions for 
controlling at least one processor to perform a method for detecting click spamming of an 
advertisement on a server, the method comprising: 

determining a quantity number of non-malicious users accessing the server; 

determining an assumed percentage of the non-malicious users clicking the 
advertisement when the advertisement is provided to the non-malicious users; 

receiving a plurality of clicks on the advertisement; 

determining [[a]] an actual percentage , out of the plurality of clicks on the 
advertisement, of clicks on the advertisement by the non-malicious users clicking the advertisement 
when the advertisement is provided to the non-malicious users; 

comparing the assumed percentage to the actual percentage; [[and]] 
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determining whether the advertisement has been click spammed based at least in part 

on the determined percentage comparing; and 

taking a remedial measure when it is determined that the advertisement has been click 

spammed 

18. (Previously presented) A server comprising: 

a memory to store at least one advertisement; and 

a processor to: 

cause the at least one advertisement to be presented, 

determine a number of non-malicious users accessing the server, 

determine a percentage of the non-malicious users clicking the at least one 

advertisement, and 

determine whether the at least one advertisement has been click spammed 
based at least in part on the determined percentage. 

19. (Previously presented) A method performed by one or more server devices, the 
method comprising: 

identifying, by one or more processors of the one or more server devices, a group of 
non-malicious users visiting a web site; 

determining, by one or more processors of the one or more server devices, a click rate 
of an item associated with the web site for the group of non-malicious users; and 

determining, by one or more processors of the one or more server devices, whether 
the item has been click spammed based at least in part on the determined click rate for the non- 
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malicious users. 

20. (Previously presented) The method of claim 19 further comprising: 
determining a total number of users visiting the web site, and 

where the determining whether the item has been click spammed includes: 

comparing the determined click rate for the non-malicious users to a click rate 

for the total number of users visiting the web site, and 

determining that the item has been click spammed when the click rate for the 

total number of users exceeds the determined click rate for the non-malicious users. 

2 1 . (Previously presented) The method of claim 1 9 where the identifying includes: 
tracking an activity of users visiting the web site, and 

identifying the group of non-malicious users based at least in part on the tracked 

activity. 

22. (Previously presented) The method of claim 21 where the tracking includes 
determining, for each user, at least one of whether the user loads images, an age of a cookie 
associated with each user, whether the user has javascript turned on, a type of browser used by the 
user, or an interval at which the user visits the web site. 

23. (Original) The method of claim 19 further comprising: 

taking remedial measures in response to determining that the item has been click 

spammed. 
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24. (Previously presented) The method of claim 19 where the determining a click rate of 
the item for the group of non-malicious users includes: 

estimating a percentage of non-malicious users visiting the web site, and 
setting a percentage of clicks of the item from non-malicious users to approximately 
equal the estimated percentage. 

25. (Previously presented) The method of claim 24 where the determining whether the 
item has been click spammed includes: 

determining whether an actual click rate of the item for the group of non-malicious 
users differs from the set percentage of clicks of the item. 

26. (Previously presented) The method of claim 19 where the determining a click rate of 
the item includes: 

determining different click rates of the item for the group of non-malicious users, the 
different click rates corresponding to different time periods. 

27. (Previously presented) The method of claim 26 where the different time periods 
include different times of a day or week. 

28. (Previously presented) The method of claim 26 where the different time periods 
include different months of a year. 
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29. (Previously presented) A computer-readable memory device containing instructions 
for controlling at least one processor to perform a method for detecting a spamming of an 
advertisement displayed by a server, the method comprising: 

identifying non- malicious visitors to the server, where identifying the non-malicious 
visitors includes identifying that the non-malicious visitors are not spam programs; 

determining a click rate of the advertisement for the non-malicious visitors; and 
determining whether the advertisement has been spammed based at least in part on 
the determined click rate for the non-malicious visitors. 

30. (Previously presented) A server comprising: 
a memory to store at least one item; and 

a processor to: 

cause the at least one item to be displayed, 

identify a number of non-malicious users accessing the server, 

compare the number of non-malicious users to a total number of users to 

obtain a percentage, 

set a click rate of the at least one item based at least in part on the percentage, 

and 

determine whether the at least one item has been spammed based at least in 

part on the click rate. 

3 1 . (Currently amended) A method performed by one or more processors of one or more 
server devices, the method comprising: 
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tracking, by one or more processors of the one or more server devices, activities of 

users visiting a web site that includes one or more advertising links, the tracking including 

determining, for each user, at least one of: 

whether the user loads images, 

an age of a cookie associated with each user, 

whether the user has javascript turned on, 

a type of browser used by the user, or 

an interval at which the user visits the web site; 
identifying, by one or more processors of the processo r one or more server devices , 
non-malicious users from among the users visiting the web site based at least in part on the tracked 
activities; 

determining , by one or more processors of the one or more server devices, whether 
the advertising link has been spammed, where the determining includes: 

comparing an actual click rate of the advertising link by non-malicious users 
to an estimated click rate of the advertising link by non-malicious users, where the estimated click 
rate is based at least in part on historical data that includes data indicating a click rate of the 
advertising link by non-malicious users during a previous time period . 

32. (Previously presented) The system of claim 16 where the means for identifying non- 
malicious visitors includes at least one of: 

means for determining whether visitors to the web site load images, 

means for determining whether the visitors to the web site have javascript turned on, 

means for determining a type of browser used by the visitors to the web site, 
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means for determining an interval at which the visitors to the web site visit the web 

site, or 

means for determining a type of items for which searches are performed by the 
visitors to the web site. 

33. (Previously canceled) 

34. (Currently amended) The computer-readable memory device of claim 17 where the 
determining whether the advertisement has been click spammed based at least in part on the 
determined percentage includes: comparing the determined expected percentage of the non- 
malicious users clicking the advertisement is based at least in part on [[to]] a percentage of non- 
malicious users clicking the advertisement from a different time period. 

35. (Currently amended) The computer-readable memory device of claim 17 where the 
determining whether the advertisement has been click spammed includes: 

estimating a percentage - of non malicious users clicking the advertisement to bo 
approximately a percentage of non malicious users accessing the server, and 

determining that the advertisement has been clicked spammed when the actual 
determined percentage of non-malicious users clicking the advertisement is lower than the estimated 
percentage of non-malicious users clicking the advertisement. 

36. (Previously presented) The server of claim 18 where, when determining whether the 
at least one advertisement has been click spammed, the processor is to: 
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compare the determined percentage of the non-malicious users clicking the at least 

one advertisement to a percentage of non-malicious users clicking the at least one advertisement 

from a different time period. 

37. (Previously presented) The server of claim 18 where, when determining whether the 
at least one advertisement has been click spammed, the processor is to: 

estimate a percentage of non-malicious users clicking the at least one advertisement 
to be approximately a percentage of non-malicious users visiting the server, and 

determining that the at least one advertisement has been clicked spammed when the 
determined percentage of non-malicious users clicking the at least one advertisement is lower than 
the estimated percentage of non-malicious users clicking the at least one advertisement. 

38. (Previously presented) The computer-readable memory device of claim 29 where the 
method further comprises: 

determining a total number of visitors to the server, and 

where the determining whether the advertisement has been spammed includes: 

comparing the determined click rate for the non-malicious visitors to a click 
rate for the total number of visitors to the web site, and 

determining that the advertisement has been spammed when the click rate for 
the total number of visitors exceeds the determined click rate for the non-malicious visitors. 

39. (Previously presented) The computer-readable memory device 29 where the 
identifying non-malicious visitors to the server includes: 
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tracking a factor associated with visitors to the server, the factor including at least one 
of whether the visitors load images, ages of cookies associated with the visitors, whether the visitors 
have javascript turned on, types of browsers used by the visitors, or intervals at which the visitors 
visit the server, and 

using the tracked factor to identify the non-malicious visitors to the server. 

40. (Previously presented) The server of claim 30 where, when identifying a number of 
non-malicious users accessing the server, the processor is to: 

track a factor associated with users accessing the server, the factor including at least 
one of whether the users load images, ages of cookies associated with the users, whether the users 
have javascript turned on, types of browsers used by the users, or intervals at which the users access 
the server, and 

use the factor to identify the number of non-malicious users accessing the server. 

41 . (Previously presented) The server of claim 30 where the at least one item includes an 
advertisement. 

42. (Currently amended) The method of claim 31 further comprising: 

determining a quantity of the identified non-malicious users that clicks the 
advertisement link; and 

determining whether the advertisement has been spammed based at least in part on 
the determined quantity of the identified non-malicious users that clicks the advertisement. 



- 15- 



PATENT 

U.S. Patent Application No. 10/608,550 
Attorney's Docket No. 0026-0027 

43. (Currently amended) The method of claim 3 1 further comprising: 

determining that spamming occurs on the web site based at least in part on a behavior 
of the non-malicious users visiting the web site. 

44. (Currently amended) The method of claim 1 where the determining the occurrence of 
spamming on the web site further includes: 

determining, based at least in part on the comparing, that the identified first 
proportion is greater than the identified second proportion. 

45. (Currently amended) The method of claim 1 where the determining that the 
occurrence of spamming on the web site further includes: 

determining, based at least in part on the comparing, that the identified first 
proportion is greater than the identified second proportion plus a predefined threshold. 

46. (Previously presented) The system of claim 16 where the means for identifying 
malicious visitors comprise means for identifying spam programs. 
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